CVEvulnerability
CVE-2013-0004
9.3 HIGH
Official page ↗
- Status
- Modified
- Published
- 2013-01-09
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-20
Description
Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly validate the permissions of objects in memory, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application, aka "Double Construction Vulnerability."
Affected configurations
• microsoft .net framework 1.0
• microsoft .net framework 1.1
• microsoft .net framework 2.0
• microsoft .net framework 4.0
• microsoft .net framework 3.5
• microsoft .net framework 3.5.1
• microsoft .net framework 4.5
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- http://www.us-cert.gov/cas/techalerts/TA13-008A.html US Government Resource
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-004 docs.microsoft.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16339 oval.cisecurity.org
- http://www.us-cert.gov/cas/techalerts/TA13-008A.html US Government Resource
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-004 docs.microsoft.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16339 oval.cisecurity.org